Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,141 detections
Filters
Last updated
All Time
Detection languages
2,292
246
196
179
104
Contributors
738
670
569
284
148
Categories
1,163
747
693
623
440
Platforms
39,921
7,246
6,535
3,864
3,627
3,141
Products / Services
2,849
742
268
187
182
MITRE Techniques
871
856
778
768
738
CVEs
13
5
2
1
1
IDS Classtypes
3
2
2
2
1
IDS Protocols
9
1
1
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Detects scenarios where an account experiences mail bombing activity followed closely by a suspicious Microsoft Teams chat initiation by an external user within a 2-hour window, potentially indicating a multi-stage social engineering or extortion campaign.
This rule monitors for network and user interaction with known phishing domains that impersonate Microsoft, Outlook, or Teams services. It aggregates data from DNS queries, device network connections, inbound email URL links, and web URL click events to identify potential phishing attempts using a community-sourced watchlist from phishunt.io.
Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts.
Another small hunting idea using CallActivityEvents Table. The query extracts the Top-Level Domain (TLD) from the person performing the action in a Microsoft Teams call and enriches it with an external country list. In this example, I exclude .CH to quickly surface activity where the originator is using a domain associated with another country. A different hunting angle to spot unexpected external participants, unusual call activity, or simply identify interactions that deserve a closer look. Of course, a foreign TLD is not malicious by itself — it is just another piece of context for the hunter. 🔎
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Detects historical network connections, URL clicks, browser launches, email URLs, and process command lines associated with Wazza phishkit infrastructure IOCs including boegl-krysl.eu, coppietersrecherche.eu, and beacon-surge-sync.workers.dev.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption.
This rule detects a suspicious sequence of events where a user performs an unusual device-code authentication (potentially indicative of device code phishing) followed shortly by an OAuth application consent or permission grant event. It flags potential compromise if the sign-in is new for the user or occurs in a short timeframe, with optional indicators associated with the 'maillive.sbs' phishing infrastructure.
Detects sign-in activity originating from a known suspicious VPN/proxy IP range targeting critical Microsoft 365 applications. The rule specifically monitors for instances where multi-factor authentication (MFA) enforcement appears to be absent or failed, suggesting a potential account compromise and subsequent data access attempt via a proxy/VPN.
Page 4 of 150